CCIE Security
Domain 1Objective 3
1.3 Security Features on Cisco IOS/IOS XE CCIE-SECURITY Practice Questions (Page 5)
Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)
42questions here
9free pages
11concepts
20%of the exam
Questions 21–25
- 21
What is the default action for traffic between two zones in a zone-based firewall when no policy is configured?
Select an answer first - 22
Which command is used to define a zone pair in a zone-based firewall?
Select an answer first - 23
A university network administrator needs to identify which applications are consuming bandwidth on the campus edge router. The goal is to see real-time application usage without disrupting traffic, then later create policies to prioritize video conferencing. What should the administrator configure first?
Select an answer first - 24
Users report that they cannot access the internet from the internal network. The router has NAT and a zone-based firewall configured. The administrator checks 'show ip nat translations' and sees no translations. What is the most likely cause?
Select an answer first - 25
A company has a dual-homed router with two internet service providers (ISPs). The inside network uses private IPs. The router runs a zone-based firewall and NAT. Users on the inside can browse the internet, but when they try to access a specific external server that requires a source IP from ISP-A, the connection fails. The firewall policy allows all outbound traffic. What is the most likely cause?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.